Prevent CRTBs from being created with mismatching Namespace and ClusterName

docs.md

@@ -57,7 +57,9 @@ Users can only create/update ClusterRoleTemplateBindings which grant permissions
 
 Users cannot create ClusterRoleTemplateBindings which violate the following constraints:
 - Either a user subject (through `UserName` or `UserPrincipalName`) or a group subject (through `GroupName` or `GroupPrincipalName`) must be specified; both a user subject and a group subject cannot be specified
-- `ClusterName` must be specified
+- `ClusterName` must:
+  - Be provided as a non-empty value
+  - Match the namespace of the ClusterRoleTemplateBinding
 - The roleTemplate indicated in `RoleTemplateName` must be:
   - Provided as a non-empty value
   - Valid (i.e. is an existing `roleTemplate` object of given name in the `management.cattle.io/v3` API group)

pkg/resources/management.cattle.io/v3/clusterroletemplatebinding/ClusterRoleTemplateBinding.md

@@ -8,7 +8,9 @@ Users can only create/update ClusterRoleTemplateBindings which grant permissions
 
 Users cannot create ClusterRoleTemplateBindings which violate the following constraints:
 - Either a user subject (through `UserName` or `UserPrincipalName`) or a group subject (through `GroupName` or `GroupPrincipalName`) must be specified; both a user subject and a group subject cannot be specified
-- `ClusterName` must be specified
+- `ClusterName` must:
+  - Be provided as a non-empty value
+  - Match the namespace of the ClusterRoleTemplateBinding
 - The roleTemplate indicated in `RoleTemplateName` must be:
   - Provided as a non-empty value
   - Valid (i.e. is an existing `roleTemplate` object of given name in the `management.cattle.io/v3` API group)

pkg/resources/management.cattle.io/v3/clusterroletemplatebinding/validator.go

@@ -81,6 +81,7 @@ func (a *admitter) Admit(request *admission.Request) (*admissionv1.AdmissionResp
 	defer listTrace.LogIfLong(admission.SlowTraceDuration)
 
 	fieldPath := field.NewPath("clusterroletemplatebinding")
+	var warnings []string
 
 	if request.Operation == admissionv1.Update {
 		oldCRTB, newCRTB, err := objectsv3.ClusterRoleTemplateBindingOldAndNewFromRequest(&request.AdmissionRequest)
@@ -91,6 +92,10 @@ func (a *admitter) Admit(request *admission.Request) (*admissionv1.AdmissionResp
 		if err := validateUpdateFields(oldCRTB, newCRTB, fieldPath); err != nil {
 			return admission.ResponseBadRequest(err.Error()), nil
 		}
+
+		if newCRTB.ClusterName != newCRTB.Namespace {
+			warnings = append(warnings, "Using CRTBs with namespaces and clusterNames that differ is not supported")
+		}
 	}
 
 	crtb, err := objectsv3.ClusterRoleTemplateBindingFromRequest(&request.AdmissionRequest)
@@ -123,6 +128,9 @@ func (a *admitter) Admit(request *admission.Request) (*admissionv1.AdmissionResp
 	response := &admissionv1.AdmissionResponse{}
 	auth.SetEscalationResponse(response, auth.ConfirmNoEscalation(request, rules, crtb.ClusterName, a.resolver))
 
+	if warnings != nil {
+		response.Warnings = warnings
+	}
 	return response, nil
 }
 
@@ -160,13 +168,17 @@ func (a *admitter) validateCreateFields(newCRTB *apisv3.ClusterRoleTemplateBindi
 	hasGroupTarget := newCRTB.GroupName != "" || newCRTB.GroupPrincipalName != ""
 
 	if (hasUserTarget && hasGroupTarget) || (!hasUserTarget && !hasGroupTarget) {
-		return field.Forbidden(fieldPath, "binding must target either a user [userId]/[userPrincipalId] OR a group [groupId]/[groupPrincipalId]")
+		return field.Forbidden(fieldPath, "binding must target either a user [userName]/[userPrincipalName] OR a group [groupName]/[groupPrincipalName]")
 	}
 
 	if newCRTB.ClusterName == "" {
 		return field.Required(fieldPath.Child("clusterName"), reason)
 	}
 
+	if newCRTB.ClusterName != newCRTB.Namespace {
+		return field.Forbidden(fieldPath, "clusterName and namespace must be the same value")
+	}
+
 	if newCRTB.RoleTemplateName == "" {
 		return field.Required(fieldPath.Child("roleTemplateName"), reason)
 	}

pkg/resources/management.cattle.io/v3/clusterroletemplatebinding/validator_test.go

@@ -668,10 +668,11 @@ func (c *ClusterRoleTemplateBindingSuite) Test_Create() {
 		username string
 	}
 	tests := []struct {
-		name    string
-		args    args
-		wantErr bool
-		allowed bool
+		name     string
+		args     args
+		wantErr  bool
+		allowed  bool
+		warnings []string
 	}{
 		{
 			name: "base test valid CRTB",
@@ -793,7 +794,6 @@ func (c *ClusterRoleTemplateBindingSuite) Test_Create() {
 			},
 			allowed: false,
 		},
-
 		{
 			name: "locked role template, crtb owned by grb",
 			args: args{
@@ -842,7 +842,6 @@ func (c *ClusterRoleTemplateBindingSuite) Test_Create() {
 			},
 			allowed: false,
 		},
-
 		{
 			name: "locked role template, crtb owned by missing grb",
 			args: args{
@@ -875,6 +874,39 @@ func (c *ClusterRoleTemplateBindingSuite) Test_Create() {
 			},
 			wantErr: true,
 		},
+		{
+			name: "create mismatched clusterName and namespace",
+			args: args{
+				username: adminUser,
+				oldCRTB: func() *apisv3.ClusterRoleTemplateBinding {
+					return nil
+				},
+				newCRTB: func() *apisv3.ClusterRoleTemplateBinding {
+					baseCRTB := newDefaultCRTB()
+					baseCRTB.ClusterName = "c-mismatch"
+					return baseCRTB
+				},
+			},
+			allowed: false,
+		},
+		{
+			name: "update mismatched clusterName and namespace",
+			args: args{
+				username: adminUser,
+				oldCRTB: func() *apisv3.ClusterRoleTemplateBinding {
+					baseCRTB := newDefaultCRTB()
+					baseCRTB.ClusterName = "c-mismatch"
+					return baseCRTB
+				},
+				newCRTB: func() *apisv3.ClusterRoleTemplateBinding {
+					baseCRTB := newDefaultCRTB()
+					baseCRTB.ClusterName = "c-mismatch"
+					return baseCRTB
+				},
+			},
+			allowed:  true,
+			warnings: []string{"Using CRTBs with namespaces and clusterNames that differ is not supported"},
+		},
 	}
 
 	for i := range tests {
@@ -892,6 +924,15 @@ func (c *ClusterRoleTemplateBindingSuite) Test_Create() {
 				if resp.Allowed != test.allowed {
 					c.Failf("Response was incorrectly validated", "Wanted response.Allowed = '%v' got '%v': result=%+v", test.name, test.allowed, resp.Allowed, resp.Result)
 				}
+				// check warnings
+				if test.warnings != nil {
+					if len(test.warnings) != len(resp.Warnings) {
+						c.Failf("Number of warnings in response different from expected", "Wanted response.Warnings: '%v' got '%v'", test.warnings, resp.Warnings)
+					}
+					for w := range test.warnings {
+						assert.Equal(c.T(), test.warnings[w], resp.Warnings[w])
+					}
+				}
 			}
 		})
 	}